Governance of Cyber Security

What is the project about?

Instead of regarding cyber security as primarily a technical challenge, we look at the problem from a socio-technical perspective – combining large-scale, technical measurement data from computer science with institutional data on thousands of actors – so as to identify the incentives of these actors and design policies that can affect real change. 

We look at the problems from an economic point of view, from the motivation of the actors involved, and with a view to designing policies that can affect real change. This has opened up a whole new area of work where we can measure the security performance of thousands of providers, identify their incentives and study the impact of policy interventions in an empirical and practical way.

How does the project impact society?

Cyber security is becoming increasingly important. Ever more affairs in our society are inseparably connected by and with online applications such as banking, travel, energy, telecommunications and health services. The consequences of cybercrime impose a large burden on society and can potentially be disruptive. We contribute to solving cyberspace dilemma’s by carrying out research and disseminating the research results through the TPM Economics of Cyber Security Group. We work directly with governments, ISPs, the police, banks and other stakeholders.

The Cyber Security Group has participated in several conferences on cyber security organised by external parties such as the Dutch government and the national security cluster The Hague Security Delta (HSD). The group is carrying out projects funded by NWO: one on security reputation metrics for Internet intermediaries, and one on improving self-cleaning practices of providers via abuse reporting mechanisms. Additional funding has been granted via two EU projects: the Advanced Cyber Defence Centre, which develops anti-botnet services for European operators and users, and the ECRIME project, which studies the economic impact of cybercrime on non-ICT sectors, such as health care and the chemical industry. Another project is MALPAY, a collaborative research project on malware-based attacks on payment services initiated with VU Amsterdam, the Dutch police, ING bank, ABN-AMRO bank, Rabobank and Fox-IT.

The Cyber Security Group has carried out studies for the ITU, the OECD and the Dutch government on the economics of malware and the role of Internet Service Providers in botnet mitigation. The group’s work has been covered widely by the media, including the BBC and countless Dutch media and security websites. Michel van Eeten, leader of the group, is a member of the Dutch Cyber Security Council.

A joint Master’s specialisation in cyber security has been started with 4TU partners Twente University, TU Eindhoven and Wageningen University. Another Master’s programme has been developed, together with Leiden University and Haagse Hogeschool, to train professionals working in IT-related sectors: it is called the Cyber Security Academy (CSA) and is also supported by the municipality of The Hague. The group also developed the first worldwide Professional Education MOOC on edX, focusing on the Economics of Cyber Security. It was followed by an international audience of 400 fee-paying professionals of all ages with backgrounds in economics, cyber security, psychology and computer science. The course provided webinars in Google Hangouts and discussion in a LinkedIn group.